Skip to content
skopnix
← Adversaries

File · karma · Crime · refreshed 2026-10-18

karma

  • COBALT MYSTIQUE
  • Handala Hack
  • Homeland Justice
  • Karmabelow80
  • BANISHED KITTEN
  • Red Sandstorm

MITRE G1055 ↗

karma — ATT&CK roseKA

attack rose · 63 techniques across 14 tactics

Analyst brief

Karma is a ransomware group first observed in mid-2021, part of a lineage tracing back through Nefilim and FiveHands, operating double-extortion attacks against enterprises in healthcare, manufacturing, and technology; the group was managed by threat actor "farnetwork" who ran multiple RaaS programs across related strains. Platforms: Windows and Linux

Observed targets (as stated by the sources)

3 countries · 0 sectors
AlbaniaIsraelUnited States

assessed originnot stated by sourcesobserved targets · 3

countries · 3

  • Albania
  • Israel
  • United States

as stated by the cited sources, not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

63 techniques · 14 of 15 tactics

  1. Reconnaissance

    2 techniques

  2. Resource development

    9 techniques

  3. Initial access

    3 techniques

  4. Execution

    6 techniques

  5. Persistence

    3 techniques

  6. Stealth

    9 techniques

  7. Defense impairment

    2 techniques

  8. Credential access

    5 techniques

  9. Discovery

    2 techniques

  10. Lateral movement

    1 technique

  11. Collection

    9 techniques

  12. Command and control

    5 techniques

  13. Exfiltration

    1 technique

  14. Impact

    6 techniques

select a technique

Detections

12 rules · Sigma · QRadar · Cortex

  1. Behaviour (ATT&CK technique)

    LSASS memory dump via comsvcs.dll MiniDump (T1003.001)

    APT1 · APT15 · APT27 · APT28 · APT3 · APT32 · 39 more

    T1003.001conf 90SIGAQLXQL

  2. Behaviour (ATT&CK technique)

    Shadow copy or backup catalog deletion (T1490)

    blackbyte · karma · Medusa Group · Sandworm · Scattered Spider · Storm-0501 · 2 more

    T1490conf 85SIGAQLXQL

  3. Behaviour (ATT&CK technique)

    certutil used to download a remote file (T1105)

    APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · 85 more

    T1105conf 80SIGAQLXQL

  4. Behaviour (ATT&CK technique)

    PowerShell download cradle executed from the command line (T1059.001)

    APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · 81 more

    T1059.001conf 80SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

6 sources
  1. 1.attack.mitre.org/groups/G1055
  2. 2.research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi
  3. 3.justice.gov/opa/media/1431956/dl?inline
  4. 4.dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem…
  5. 5.unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats
  6. 6.sophos.com/en-us/threat-profiles/cobalt-mystique

Track karma on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.